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By this amendment, claims 1-32 are pending, in which claims 1,4, 8, 9, 16-23, and 25- 
30 are currently amended, and no claims are canceled, withdrawn from consideration, or newly 
presented. No new matter is introduced. 

The Office Action mailed May 19, 2004 rejected claim 4 under 35 U.S.C. § 112, second 
paragraph, claims 1, 6-7, 9, 14-15, 17-20, and 22-23 under 35 U.S.C. § 103(a) as obvious over Ji 
et al (U.S. 5,623,600) in view of Shanklin et al (U.S. 6,578,147), claims 2-4, 10-12, and 24-30 
under 35 U.S.C. § 103(a) as obvious over Ji et al in view of Shanklin et al and further in view 
of Wells (U.S. 6,338,141), claims 5, 13, 21, and 31-32 under 35 U.S.C. § 103(a) as obvious over 
Ji et al in view of Shanklin et al and further in view of Xu (U.S. Patent Application Publication 
No. 2002/0032766), and claims 8 and 16 under 35 U.S.C. § 103(a) as obvious over Ji et al in 
view of Shanklin et al and further in view of Wells and Xu. 

Claim 4 has been amended to recite "the detection management system," and thus the 
rejection under 35 U.S.C. § 112 should be withdrawn. {See, e.g., specification, page 4, lines 21- 
27) 

Applicants respectfully traverse the rejections under 35 U.S.C. § 103, in that none of Ji et 
al, Shanklin et al, Xu, nor Wells, singly or in combination, discloses the claimed features 
particularly as now amended. 

For example, amended independent claims 1, 8, 9, and 16 each includes the feature 
"distributing a common copy of the flow to each of the scanning computer systems in 
parallel." Amended independent claims 17, 18, and 19 each recite "duplicating the flow to 
produce a plurality of common copies of the flow." Amended independent claims 20 and 21 
each recite "receiving respective common copies of a flow of content from the front-end 
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processor in parallel." Amended independent claims 22, 25, and 28 each include the feature 
"receiving an alarm ... when a common flow of content scanned by the scanning computer 
systems in parallel contains malicious code, said common flow including at least one of a 
hypertext markup file and a transferred file." The Office Action acknowledges that // et al fails 
to teach these features, and relies on Shanklin et al (Office Action, Page 3, line 20 - Page 4, line 
13) 

In stark contrast, Shanklin et al (col. 2: 59 - col. 3: 3; col. 5: 21-28; col. 5: 56-62) 
discloses sending different packets or sessions to each of multiple processors for processing 
different packets or sessions in parallel. In its discussion of the embodiment of FIG. 2, 
Shanklin et al states, "Thus, each sensor handles one-third of the sessions in a given 
datastream." (col. 5: 27-28) Further, in its discussion of the embodiment of FIG. 3, Shanklin 
et al states, "Even in this situation, each sensor 31 processes only one-third of the packets." 
(col. 5: 67 - col. 6: 1) Additionally, Shanklin et al states, "Specifically, a 'copy to' operation 
is used to send each packet to the appropriate sensor as well as to the destination in local 
network 10 to which the packet is addressed." (col. 6: 39-41) Thus, Shanklin et al fails to 
suggest or disclose these features. Thus, Applicants respectfully submit that no reasonable 
combination of Ji et al and Shanklin et al suggests or discloses "distributing a common copy 
of the flow to each of the scanning computer systems in parallel." 

With respect to dependent claims 2-4 and 10-12, the Office Action, in its "Response to 
Amendment" section on page 11, lines 4-9, acknowledges that the "Wells reference is used to fill 
in the gap for the limitation 'a database containing rules configured for creating a signature of a 
piece of malicious code detected by at least one of the scanning computer system', and updating 
the detection system by the detection manager recited in claims 2-4, 10-12," and thus that Wells 
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also does not disclose or suggest the features absent from the combination of // et al and 
Shanklin et al 

Regarding the rejection of claims 5, 13, 21, and 31-32, the Office Action correctly 
acknowledges, "Modified Ji-Shanklin fails to teach scanning computer systems configured to 
execute respective anti-virus scanning software having different, corresponding coverage of 
malicious code," and thus relies on Xu, stating, "It would have been obvious to one of ordinary 
skill in the art to modify the modified Ji-Shanklin' s parallel sensors to incorporate virus scanning 
software differ [sic] in their capabilities be used [sic] as a "safety net" to improve the chances of 
detecting a virus, see page 18, paragraphs 228 (Xu)." (Office Action, Page 7-8) 

However, even if one skilled in the art would have been motivated to combine Ji et al 

and Shanklin et al, any "modified Ji-Shanklin parallel sensors" would be unsuitable for 

incorporating the virus scanning software of Xu. As discussed previously, Shanklin et al sends 

different packets to each of multiple processors, with each processor configured to perform 

processing that is identical to each other processor, but processing different packets in parallel, 

and each of the sensors receives sessions or packets (depending on the embodiment as shown in 

Shanklin et al) that are different from the sessions or packets received by the other sensors. 

Xu states, at page 18, f 228: 

In FIG. 23, the ISP network 2390 includes a packeting engine 2300 
between clients 2321-2323 and the network service providers 2381-2383 coupled 
to the Internet 2385. The packeting engine 2300 directs the client packets through 
a series of appliances, including an intrusion detection system 2351 one or more 
virus scanning devices 2352-2353, and one or more of firewalls 2361-2363. Since 
companies that create virus scanning software differ in their capabilities to 
detect viruses and to issue timely virus signature updates, multiple virus scanning 
devices may be used as a "safety net" to improve the chances of detecting a virus. 

Thus, each of the virus scanning devices 2352-2353 performs processing that is different 

from the other device, with each device processing the same content as the other device to 
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"improve the chances of detecting a virus." Thus, if packets or sessions were sent to device 2352 
that are different from the packets or sessions sent to device 2353 of Xu, the result would yield 
only partially processed portions of the content, with one portion receiving one type of 
processing, and a different portion receiving a different type of processing (i.e., each portion only 
receiving a single type of virus detection processing), which is contrary to Xus stated purpose for 
using the devices 2352-2353. Therefore, one skilled in the art would have no motivation to 
combine Xu with any "modified Ji-Shanklin parallel sensors." If a proposed modification would 
render the prior art being modified unsatisfactory for its intended purpose, then there is no 
suggestion or motivation to make the proposed modification. In re Gordon, 733 F.2d 900, 221 
USPQ 1125 (Fed. Cir. 1984). Obviousness rejections require some evidence in the prior art of a 
teaching, motivation, or suggestion to combine and modify the prior art references. See, e.g., 
McGinley v. Franklin Sports, Inc., 262 F.3d 1339, 1351-52, 60USPQ2d 1001, 1008 (Fed. Cir. 
2001); Brown & Williamson Tobacco Corp. v. Philip Morris Inc., 229 F.3d 1120, 1124-25, 56 
USPQ2d 1456, 1459 (Fed. Cir. 2000); In re Dembiczak, 175 F.3d 994, 999, 50USPQ2d 1614, 
1617 (Fed. Cir. 1999). Thus, the obviousness rejection of claims 5, 13, 21, and 31-32 should be 
withdrawn. 

Accordingly, the rejection of dependent claims 2-7, 10-15, 23-24, 26-27, and 29-32 
should be withdrawn for at least the same reasons as those discussed above with regard to their 
respective independent claims, and these claims are separately patentable on their own merits. 

Applicants further respectfully submit that many claims are rejected improperly 
throughout the Office Action. For example, regarding the rejection of at least claim 8, the Office 
Action improperly gives no reasons why the applied references suggest at least claim 8 or 16, 
e.g., at Page 8, line 10, asserting, "Claim 8 is an apparatus corresponding to method claims 1-7." 
The Office Action apparently relies on various combinations of words recited in the claims to 
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assemble a rejection based on the occurrences of those words in other claims, for example, "see 
the statement of rejections of claims 2-3 above" at Page 8, lines 14-15; "see the statement of 
rejections of claims 1 and 5 above" at Page 8, lines 19-20; "see the statement of rejections of 
claims 1 and 6 above" at Page 9, lines 3-4; "see the statement of rejections of claims 1 and 2 
above" at Page 9, lines 8-9; "see the statement of rejections of claims 1, 4 and 7 above" at Page 
9, line 15. The Office Action, at Page 9, lines 16-17, then states, "Claim 8 is rejected for the 
same reasons provided in the rejections of claims 1-7 above." Furthermore, the Office Action, at 
Page 9, lines 18-20, then states, "(Amended) claim 16 is a method claim reciting limitations 
(broader in scope) of apparatus claim 8. Claim 16 is rejected for the same reasons provided in 
the statement of rejections of claims 8 and 1-7 above." There is no explanation preferred as to 
how or why any of the applied references, either singly or in combination, apply to claim 8 or 
claim 16 specifically, other than a combination of recitations of "see the statement of rejections" 
for various combinations of claims that were rejected on different grounds (e.g., claims "1 and 
5", claims "1 and 2"). 

Similarly, the rejections at least of claim 20 (rejected by stating, "an apparatus claim 
reciting limitations of claims 1 and 6" (Office Action, Page 5)) and claims 22-23 (rejected by 
stating, "Apparatuses implementing features of claims 1, 6 and 7" (Office Action, Page 5)) are 
improper. As clearly stated by the MPEP § 2141.02, "Ascertaining the differences between the 
prior art and the claims at issue requires interpreting the claim language, and considering both the 
invention and the prior art references as a whole." Further, "In determining the differences 
between the prior art and the claims, the question under 35 U.S.C. 103 is not whether the 
differences themselves would have been obvious, but whether the claimed invention as a whole 
would have been obvious. Stratoflex, Inc. v. Aeroquip Corp., 713 F.2d 1530, 218 USPQ 871 
(Fed. Cir. 1983); Schenck v. Nortron Corp., 713 F.2d 782, 218 USPQ 698 (Fed. Cir. 1983)" 
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The Patent Office must give specific reasons why one of ordinary skill in the art would 
have been motivated to combine the references. See, e.g., In re Kotzab, 217 F.3d 1365, 1371, 55 
USPQ2d 1313, 1317 (Fed. Cir. 2000); In re Rouffet, 149 F.3d 1350, 1359, 47 USPQ2d 1453, 
1459 (Fed. Cir. 1998). Moreover, Applicants respectfully submit that the reasoning that the 
Examiner puts forth for the rejection with respect to at least claims 8 and 16 contravenes 35 
U.S.C. § 132, which requires the Director to "notify the applicant thereof, stating the reasons for 
such rejection." This section is violated if the rejection "is so uninformative that it prevents the 
applicant from recognizing and seeking to counter the grounds for rejection." Chester v. Miller, 
15 USPQ2d 1333 (Fed. Cir. 1990). This policy is captured in the Manual of Patent Examining 
Procedure. For example, MPEP § 706 states that "[t]he goal of examination is to clearly 
articulate any rejection early in the prosecution process so that applicant has the opportunity to 
provide evidence of patentability and otherwise respond completely at the earliest opportunity." 
Furthermore, MPEP § 706.02(j) indicates that: "[i]t is important for an examiner to properly 
communicate the basis for a rejection so that the issues can be identified early and the applicant 
can be given fair opportunity to respond." Therefore, if a next action maintains these rejections, 
Applicants respectfully request that the next action be made non-final to give the Applicants a 
fair opportunity to respond. 

Finally, in response to the Office Action's "Response to Amendment" section on Page 10, 
lines 18-19, Applicants respectfully submit that a mere statement that "each sensor of Shanklin et 
al is identical to the other sensors" is not necessarily an assertion by Applicants that "different 
sensors" is or is not claimed in claims 1 or 9. 
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Therefore, the present application, as amended, overcomes the objections and rejections 
of record and is in condition for allowance. Favorable consideration is respectfully requested. If 
any unresolved issues remain, it is respectfully requested that the Examiner telephone the 
undersigned attorney at 703-425-6499 so that such issues may be resolved as expeditiously as 
possible. 



10507 Braddock Road 
Suite A 

Fairfax, VA 22032 
Tel. 703-425-6499 
Fax. 703-425-8518 



Respectfully Submitted, 



DITTHAVONG & CARLSON, P C. 





Reg. No. 41,946 



Phouphanomketh Dittahvong 
Reg. No. 44,658 



Attorneys for Applicant(s) 
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